Line | Source | Count |
1 | | - |
2 | | - |
3 | | - |
4 | | - |
5 | | - |
6 | | - |
7 | | - |
8 | | - |
9 | | - |
10 | | - |
11 | | - |
12 | | - |
13 | | - |
14 | | - |
15 | | - |
16 | | - |
17 | | - |
18 | | - |
19 | | - |
20 | | - |
21 | | - |
22 | | - |
23 | | - |
24 | | - |
25 | | - |
26 | #include "includes.h" | - |
27 | | - |
28 | #include <fcntl.h> | - |
29 | #ifdef HAVE_PATHS_H | - |
30 | #include <paths.h> | - |
31 | #endif | - |
32 | #include <pwd.h> | - |
33 | #include <stdarg.h> | - |
34 | #include <stdlib.h> | - |
35 | #include <string.h> | - |
36 | #include <unistd.h> | - |
37 | #include <errno.h> | - |
38 | | - |
39 | #ifdef WITH_OPENSSL | - |
40 | #include <openssl/evp.h> | - |
41 | #include <openssl/rand.h> | - |
42 | #include <openssl/rsa.h> | - |
43 | #endif | - |
44 | | - |
45 | #include "xmalloc.h" | - |
46 | #include "log.h" | - |
47 | #include "sshkey.h" | - |
48 | #include "ssh.h" | - |
49 | #include "ssh2.h" | - |
50 | #include "misc.h" | - |
51 | #include "sshbuf.h" | - |
52 | #include "authfile.h" | - |
53 | #include "msg.h" | - |
54 | #include "canohost.h" | - |
55 | #include "pathnames.h" | - |
56 | #include "readconf.h" | - |
57 | #include "uidswap.h" | - |
58 | #include "sshkey.h" | - |
59 | #include "ssherr.h" | - |
60 | | - |
61 | struct ssh *active_state = NULL; | - |
62 | | - |
63 | extern char *__progname; | - |
64 | | - |
65 | static int | - |
66 | valid_request(struct passwd *pw, char *host, struct sshkey **ret, | - |
67 | u_char *data, size_t datalen) | - |
68 | { | - |
69 | struct sshbuf *b; | - |
70 | struct sshkey *key = NULL; | - |
71 | u_char type, *pkblob; | - |
72 | char *p; | - |
73 | size_t blen, len; | - |
74 | char *pkalg, *luser; | - |
75 | int r, pktype, fail; | - |
76 | | - |
77 | if (ret != NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
78 | *ret = NULL; never executed: *ret = ((void *)0) ; | 0 |
79 | fail = 0; | - |
80 | | - |
81 | if ((b = sshbuf_from(data, datalen)) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
82 | fatal("%s: sshbuf_from failed", __func__); never executed: fatal("%s: sshbuf_from failed", __func__); | 0 |
83 | | - |
84 | | - |
85 | if ((r = sshbuf_get_string(b, NULL, &len)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
86 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
87 | if (len != 20 && len != 32)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
88 | fail++; never executed: fail++; | 0 |
89 | | - |
90 | if ((r = sshbuf_get_u8(b, &type)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
91 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
92 | if (type != SSH2_MSG_USERAUTH_REQUEST)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
93 | fail++; never executed: fail++; | 0 |
94 | | - |
95 | | - |
96 | if ((r = sshbuf_skip_string(b)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
97 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
98 | | - |
99 | | - |
100 | if ((r = sshbuf_get_cstring(b, &p, NULL)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
101 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
102 | if (strcmp("ssh-connection", p) != 0) never executed: __result = (((const unsigned char *) (const char *) ( "ssh-connection" ))[3] - __s2[3]); never executed: end of block never executed: end of block never executed: __result = (((const unsigned char *) (const char *) ( p ))[3] - __s2[3]); never executed: end of block never executed: end of block TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
103 | fail++; never executed: fail++; | 0 |
104 | free(p); | - |
105 | | - |
106 | | - |
107 | if ((r = sshbuf_get_cstring(b, &p, NULL)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
108 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
109 | if (strcmp("hostbased", p) != 0) never executed: __result = (((const unsigned char *) (const char *) ( "hostbased" ))[3] - __s2[3]); never executed: end of block never executed: end of block never executed: __result = (((const unsigned char *) (const char *) ( p ))[3] - __s2[3]); never executed: end of block never executed: end of block TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
110 | fail++; never executed: fail++; | 0 |
111 | free(p); | - |
112 | | - |
113 | | - |
114 | if ((r = sshbuf_get_cstring(b, &pkalg, NULL)) != 0 ||TRUE | never evaluated | FALSE | never evaluated |
| 0 |
115 | (r = sshbuf_get_string(b, &pkblob, &blen)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
116 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
117 | | - |
118 | pktype = sshkey_type_from_name(pkalg); | - |
119 | if (pktype == KEY_UNSPEC)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
120 | fail++; never executed: fail++; | 0 |
121 | else if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
122 | error("%s: bad key blob: %s", __func__, ssh_err(r)); | - |
123 | fail++; | - |
124 | } else if (key->type != pktype) never executed: end of block TRUE | never evaluated | FALSE | never evaluated |
| 0 |
125 | fail++; never executed: fail++; | 0 |
126 | free(pkalg); | - |
127 | free(pkblob); | - |
128 | | - |
129 | | - |
130 | if ((r = sshbuf_get_cstring(b, &p, &len)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
131 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
132 | debug2("%s: check expect chost %s got %s", __func__, host, p); | - |
133 | if (strlen(host) != len - 1)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
134 | fail++; never executed: fail++; | 0 |
135 | else if (p[len - 1] != '.')TRUE | never evaluated | FALSE | never evaluated |
| 0 |
136 | fail++; never executed: fail++; | 0 |
137 | else if (strncasecmp(host, p, len - 1) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
138 | fail++; never executed: fail++; | 0 |
139 | free(p); | - |
140 | | - |
141 | | - |
142 | if ((r = sshbuf_get_cstring(b, &luser, NULL)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
143 | fatal("%s: buffer error: %s", __func__, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __func__, ssh_err(r)); | 0 |
144 | | - |
145 | if (strcmp(pw->pw_name, luser) != 0) never executed: __result = (((const unsigned char *) (const char *) ( pw->pw_name ))[3] - __s2[3]); never executed: end of block never executed: end of block never executed: __result = (((const unsigned char *) (const char *) ( luser ))[3] - __s2[3]); never executed: end of block never executed: end of block TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
146 | fail++; never executed: fail++; | 0 |
147 | free(luser); | - |
148 | | - |
149 | | - |
150 | if (sshbuf_len(b) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
151 | fail++; never executed: fail++; | 0 |
152 | sshbuf_free(b); | - |
153 | | - |
154 | debug3("%s: fail %d", __func__, fail); | - |
155 | | - |
156 | if (fail)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
157 | sshkey_free(key); never executed: sshkey_free(key); | 0 |
158 | else if (ret != NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
159 | *ret = key; never executed: *ret = key; | 0 |
160 | | - |
161 | return (fail ? -1 : 0); never executed: return (fail ? -1 : 0); TRUE | never evaluated | FALSE | never evaluated |
| 0 |
162 | } | - |
163 | | - |
164 | int | - |
165 | main(int argc, char **argv) | - |
166 | { | - |
167 | struct sshbuf *b; | - |
168 | Options options; | - |
169 | #define NUM_KEYTYPES 5 | - |
170 | struct sshkey *keys[NUM_KEYTYPES], *key = NULL; | - |
171 | struct passwd *pw; | - |
172 | int r, key_fd[NUM_KEYTYPES], i, found, version = 2, fd; | - |
173 | u_char *signature, *data, rver; | - |
174 | char *host, *fp; | - |
175 | size_t slen, dlen; | - |
176 | #ifdef WITH_OPENSSL | - |
177 | u_int32_t rnd[256]; | - |
178 | #endif | - |
179 | | - |
180 | ssh_malloc_init(); | - |
181 | if (pledge("stdio rpath getpw dns id", NULL) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
182 | fatal("%s: pledge: %s", __progname, strerror(errno)); never executed: fatal("%s: pledge: %s", __progname, strerror( (*__errno_location ()) )); | 0 |
183 | | - |
184 | | - |
185 | if ((fd = open(_PATH_DEVNULL, O_RDWR)) < 2)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
186 | exit(1); never executed: exit(1); | 0 |
187 | | - |
188 | if (fd > 2)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
189 | close(fd); never executed: close(fd); | 0 |
190 | | - |
191 | i = 0; | - |
192 | | - |
193 | key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY); | - |
194 | key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY); | - |
195 | key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY); | - |
196 | key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY); | - |
197 | key_fd[i++] = open(_PATH_HOST_RSA_KEY_FILE, O_RDONLY); | - |
198 | | - |
199 | if ((pw = getpwuid(getuid())) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
200 | fatal("getpwuid failed"); never executed: fatal("getpwuid failed"); | 0 |
201 | pw = pwcopy(pw); | - |
202 | | - |
203 | permanently_set_uid(pw); | - |
204 | | - |
205 | seed_rng(); | - |
206 | | - |
207 | #ifdef DEBUG_SSH_KEYSIGN | - |
208 | log_init("ssh-keysign", SYSLOG_LEVEL_DEBUG3, SYSLOG_FACILITY_AUTH, 0); | - |
209 | #endif | - |
210 | | - |
211 | | - |
212 | initialize_options(&options); | - |
213 | (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "", &options, 0); | - |
214 | fill_default_options(&options); | - |
215 | if (options.enable_ssh_keysign != 1)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
216 | fatal("ssh-keysign not enabled in %s", never executed: fatal("ssh-keysign not enabled in %s", "/var/tmp/openssh-test/etc" "/ssh_config"); | 0 |
217 | _PATH_HOST_CONFIG_FILE); never executed: fatal("ssh-keysign not enabled in %s", "/var/tmp/openssh-test/etc" "/ssh_config"); | 0 |
218 | | - |
219 | for (i = found = 0; i < NUM_KEYTYPES; i++) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
220 | if (key_fd[i] != -1)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
221 | found = 1; never executed: found = 1; | 0 |
222 | } never executed: end of block | 0 |
223 | if (found == 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
224 | fatal("could not open any host key"); never executed: fatal("could not open any host key"); | 0 |
225 | | - |
226 | #ifdef WITH_OPENSSL | - |
227 | OpenSSL_add_all_algorithms(); | - |
228 | arc4random_buf(rnd, sizeof(rnd)); | - |
229 | RAND_seed(rnd, sizeof(rnd)); | - |
230 | #endif | - |
231 | | - |
232 | found = 0; | - |
233 | for (i = 0; i < NUM_KEYTYPES; i++) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
234 | keys[i] = NULL; | - |
235 | if (key_fd[i] == -1)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
236 | continue; never executed: continue; | 0 |
237 | r = sshkey_load_private_type_fd(key_fd[i], KEY_UNSPEC, | - |
238 | NULL, &key, NULL); | - |
239 | close(key_fd[i]); | - |
240 | if (r != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
241 | debug("parse key %d: %s", i, ssh_err(r)); never executed: debug("parse key %d: %s", i, ssh_err(r)); | 0 |
242 | else if (key != NULL) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
243 | keys[i] = key; | - |
244 | found = 1; | - |
245 | } never executed: end of block | 0 |
246 | } never executed: end of block | 0 |
247 | if (!found)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
248 | fatal("no hostkey found"); never executed: fatal("no hostkey found"); | 0 |
249 | | - |
250 | if (pledge("stdio dns", NULL) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
251 | fatal("%s: pledge: %s", __progname, strerror(errno)); never executed: fatal("%s: pledge: %s", __progname, strerror( (*__errno_location ()) )); | 0 |
252 | | - |
253 | if ((b = sshbuf_new()) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
254 | fatal("%s: sshbuf_new failed", __progname); never executed: fatal("%s: sshbuf_new failed", __progname); | 0 |
255 | if (ssh_msg_recv(STDIN_FILENO, b) < 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
256 | fatal("ssh_msg_recv failed"); never executed: fatal("ssh_msg_recv failed"); | 0 |
257 | if ((r = sshbuf_get_u8(b, &rver)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
258 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
259 | if (rver != version)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
260 | fatal("bad version: received %d, expected %d", rver, version); never executed: fatal("bad version: received %d, expected %d", rver, version); | 0 |
261 | if ((r = sshbuf_get_u32(b, (u_int *)&fd)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
262 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
263 | if (fd < 0 || fd == STDIN_FILENO || fd == STDOUT_FILENO)TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
TRUE | never evaluated | FALSE | never evaluated |
| 0 |
264 | fatal("bad fd"); never executed: fatal("bad fd"); | 0 |
265 | if ((host = get_local_name(fd)) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
266 | fatal("cannot get local name for fd"); never executed: fatal("cannot get local name for fd"); | 0 |
267 | | - |
268 | if ((r = sshbuf_get_string(b, &data, &dlen)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
269 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
270 | if (valid_request(pw, host, &key, data, dlen) < 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
271 | fatal("not a valid request"); never executed: fatal("not a valid request"); | 0 |
272 | free(host); | - |
273 | | - |
274 | found = 0; | - |
275 | for (i = 0; i < NUM_KEYTYPES; i++) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
276 | if (keys[i] != NULL &&TRUE | never evaluated | FALSE | never evaluated |
| 0 |
277 | sshkey_equal_public(key, keys[i])) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
278 | found = 1; | - |
279 | break; never executed: break; | 0 |
280 | } | - |
281 | } never executed: end of block | 0 |
282 | if (!found) {TRUE | never evaluated | FALSE | never evaluated |
| 0 |
283 | if ((fp = sshkey_fingerprint(key, options.fingerprint_hash,TRUE | never evaluated | FALSE | never evaluated |
| 0 |
284 | SSH_FP_DEFAULT)) == NULL)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
285 | fatal("%s: sshkey_fingerprint failed", __progname); never executed: fatal("%s: sshkey_fingerprint failed", __progname); | 0 |
286 | fatal("no matching hostkey found for key %s %s", | - |
287 | sshkey_type(key), fp ? fp : ""); | - |
288 | } never executed: end of block | 0 |
289 | | - |
290 | if ((r = sshkey_sign(keys[i], &signature, &slen, data, dlen, NULL, 0))TRUE | never evaluated | FALSE | never evaluated |
| 0 |
291 | != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
292 | fatal("sshkey_sign failed: %s", ssh_err(r)); never executed: fatal("sshkey_sign failed: %s", ssh_err(r)); | 0 |
293 | free(data); | - |
294 | | - |
295 | | - |
296 | sshbuf_reset(b); | - |
297 | if ((r = sshbuf_put_string(b, signature, slen)) != 0)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
298 | fatal("%s: buffer error: %s", __progname, ssh_err(r)); never executed: fatal("%s: buffer error: %s", __progname, ssh_err(r)); | 0 |
299 | if (ssh_msg_send(STDOUT_FILENO, version, b) == -1)TRUE | never evaluated | FALSE | never evaluated |
| 0 |
300 | fatal("ssh_msg_send failed"); never executed: fatal("ssh_msg_send failed"); | 0 |
301 | | - |
302 | return (0); never executed: return (0); | 0 |
303 | } | - |
| | |